Privacy Policy — RecCheckMD

Last updated: September 22, 2026Questions: info@reccheckmd.com

RecCheckMD does not receive, store, or process protected health information (PHI). The service works on purchase-order and item-master data — catalog numbers, manufacturers, descriptions, quantities, dates, and facility identifiers. No patient identifiers and no clinical data. Our Terms prohibit uploading them.

1. Who we are

RecCheckMD, LLC (“RecCheckMD”, “we”) is a Tennessee limited liability company. This policy explains what information we collect when you use www.reccheckmd.com and the RecCheckMD service, how we use it, and the choices you have. If your organization has a signed agreement with us, that agreement governs our handling of your organization’s data where the two differ.

2. What we collect

Account information

Your name and work email address, provided when you sign in. Sign-in is handled by Auth0; we never see or store your password. We also record when you signed in and, for the audit trail, the actions you take in the service.

Data your organization uploads

Purchase-order and item-master files: catalog and part numbers, manufacturer and vendor names, product descriptions, quantities, unit prices, purchase dates, and facility or center identifiers. Optionally, lot and serial numbers when your file includes them.
Manufacturer recall notices that your team forwards to your organization’s RecCheckMD address, including attachments and photographed notices.
The compliance record your team builds on each alert: owner, disposition, notes, sign-offs, and due dates.

Demo requests

When you request a demo we collect your name, work email, organization, an optional phone number, and, if you arrived from a campaign link, which campaign.

Usage and technical data

Standard server logs and page-view records. For analytics we keep the page visited and a one-way hash of the IP address, not the address itself. Requests from automated crawlers are excluded.

Cookies and browser storage

We set a signed session cookie (HttpOnly, Secure), a CSRF-protection cookie, and a short-lived sign-in state cookie during the Auth0 hand-off. Browser storage holds per-device preferences such as dismissed banners and your assistant conversation. We use no advertising cookies and no third-party analytics trackers.

3. How we use it

To provide the service: matching FDA recalls against your uploaded data, maintaining your alerts and compliance records, generating reports, and sending the email and push notifications you or your organization enable.
To secure the service: authentication, abuse prevention, rate limiting, and the attributed activity trail your surveyor may ask to see.
To support you and to respond to demo requests.
To improve the service using data that is aggregated or de-identified so that it does not identify your organization, a facility, or a person.

We do not sell personal information and we do not use your data for advertising.

4. AI features

The Echo assistant and the recall-notice reader send the relevant text, and for photographed notices the image, to Anthropic’s API to produce a response. Only the data needed for that request is sent, and it is used to generate the response under Anthropic’s commercial API terms. You can use RecCheckMD without these features.

5. Who we share data with

We share data only with the service providers that run RecCheckMD, and only for the purpose listed:

Provider	Purpose	Data involved
Auth0 (Okta)	Sign-in and account identity	Name, email, sign-in events
Railway	Application hosting and the database (United States)	All service data
Cloudflare R2	File storage for uploaded files, reports, and forwarded notices	Uploaded files and generated reports
Resend	Email delivery	Recipient address and the email content
Anthropic	AI assistant and notice reading	Text and images for the specific request
U.S. FDA (openFDA, accessdata.fda.gov)	Public recall data and device identity lookups	Product identifiers used in a lookup
DuckDuckGo	Product image lookup on alert cards	Product name and manufacturer
Google Fonts, jsDelivr	Fonts and a charting library loaded by your browser	Your browser’s standard request headers

We may also disclose information when required by law or to protect the security of the service, with notice to you where the law permits.

6. How long we keep it

Account information: for the life of your account. A deleted account’s record and its sign-in identity are removed.
Uploaded data, alerts, and compliance records: for the life of your organization’s subscription. For thirty days after it ends we make the data available for export on request; after that we delete it, except for copies in routine backups.
Backups: about thirty daily backups plus monthly copies, kept in a separate storage location the application cannot write to.
Demo requests: until we have responded and the request is no longer needed.

7. Security

How we protect your data is described on our Security page. If we confirm a security incident involving unauthorized access to your organization’s data, we will notify your organization without undue delay and within seventy-two hours.

8. Your choices

Email alerts can be turned off in your account menu; push notifications are enabled per device and can be cleared there too.
Your organization’s admin can remove members, export data, and delete records. To access, correct, export, or delete information about you, email info@reccheckmd.com.

RecCheckMD is built for healthcare organizations in the United States and is not directed at children under 18.

9. Changes and contact

We will post changes to this policy here and update the date above. For questions or requests, write to info@reccheckmd.com.